Ferrum vs The Field
Historical local Docker benchmarks against Kong, Tyk, KrakenD, Envoy and Pingora. Ferrum led selected TLS and authenticated scenarios in these runs. The source summary has no tested commit or run date; it does not establish current-release rankings.
Apples-to-Apples: All Gateways in Docker
Environment
Apple Silicon (macOS). Docker Desktop with port-mapped containers. Backend echo server runs natively as a shared constant — identical for all gateways.
Test Parameters
wrk load generator. 8 threads, 100 concurrent connections, 30-second measured run with a 5-second warm-up (discarded). Gateways tested sequentially to avoid contention.
Four Scenarios
HTTP (plaintext), HTTPS (TLS termination), E2E TLS (full double encryption), and Key-Auth (HTTP + API key plugin). Two endpoints: /health (instant) and /api/users (100µs simulated latency).
Full Benchmark Table
Green = best in column · Red = worst in column. Focus on the gaps between gateways, not the absolute req/s (all values are Docker-depressed by an equal amount).
| Gateway | HTTP /health | HTTP /api/users | HTTPS /health | HTTPS /api/users | E2E TLS /health | E2E TLS /api/users |
|---|---|---|---|---|---|---|
| Baseline (direct) | 198,169 | 54,690 | 195,935 | 47,245 | — | — |
| Ferrum Edge | 27,102 | 23,772 | 26,237 | 25,558 | 24,868 | 🏆 #1 29,808 |
| Envoy 1.37 | 29,607 | 27,847 | 28,129 | 27,130 | 27,135 | 26,284 |
| KrakenD 2.13 | 23,038 | 21,894 | 22,332 | 20,565 | 21,306 | 20,554 |
| Kong 3.14 | 20,317 | 22,535 | 22,185 | 21,142 | 22,237 | 19,383 |
| Tyk v5.12 | 19,077 | 23,668 | 23,641 | 23,087 | 3,298 | 22,433 |
| Pingora | 6,579 | 5,648 | 5,102 | 5,368 | N/A* | N/A* |
* Pingora's TLS library requires a valid DNS hostname for upstream SNI and cannot connect to IP-based backends over TLS. E2E TLS is skipped — this is a framework limitation, not a configuration issue. Tyk's 3,298 req/s on E2E TLS /health reflects unstable behavior in that test scenario.
🏆 Ferrum led this historical E2E TLS workload
E2E TLS /api/users: 29,808 req/s — the single highest req/s number posted by any gateway across all scenarios. This workload used end-to-end encryption (client → gateway TLS → backend TLS) and a 100µs backend delay. Ferrum recorded 13% more throughput than Envoy in this test. That result alone does not isolate the cause or predict other deployments.
Key-Auth: The Real-World Plugin Test
Authentication, rate limiting and logging change request-path work. Compare the plugins and configuration your own deployment uses.
Key-auth throughput in the reported workload
Ferrum's unauthenticated throughput on /api/users is 23,772 req/s.
With key-auth enabled, it recorded 27,979 req/s. A higher result in a separate run does not prove zero authentication cost or establish warming as the cause.
Ferrum uses a pre-computed ConsumerIndex and Arc<Consumer>; benchmark the complete authentication path under paired, warmed conditions.
| Gateway | Key-Auth req/s | Avg Latency | vs Ferrum | Auth Method |
|---|---|---|---|---|
| Ferrum Edge | 27,979 | 3.44 ms | 🏆 Winner | Compiled Rust, Arc<Consumer> lookup |
| Envoy 1.37 | 26,787 | 3.64 ms | −4.4% | Inline Lua filter |
| Kong 3.14 | 25,009 | 3.91 ms | −12% | Lua plugin chain |
| Tyk v5.12 | 19,186 | 5.08 ms | −46% | Go middleware |
| Pingora | Excluded — no auth plugin framework | — | ||
| KrakenD | Excluded — key-auth requires Enterprise Edition | — | ||
Each request includes an apikey header validated against a pre-configured consumer. Pingora excluded (no plugin framework). KrakenD key-auth requires Enterprise Edition.
Ferrum vs Envoy
A workload-by-workload comparison with Envoy from the same historical local run.
| Scenario | Ferrum Edge | Envoy 1.37 | Advantage |
|---|---|---|---|
| HTTP /health | 27,102 req/s | 29,607 req/s | Envoy +9% |
| HTTP /api/users | 23,772 req/s | 27,847 req/s | Envoy +17% |
| HTTPS /health | 26,237 req/s | 28,129 req/s | Envoy +7% |
| HTTPS /api/users | 25,558 req/s | 27,130 req/s | Envoy +6% |
| E2E TLS /health | 24,868 req/s | 27,135 req/s | Envoy +9% |
| E2E TLS /api/users | 🏆29,808 req/s | 26,284 req/s | Ferrum +13% |
| Key-Auth /api/users | ✓27,979 req/s | 26,787 req/s | Ferrum +4% |
Where Envoy Leads
Envoy recorded a 6–17% lead on minimal pass-through proxying with no plugins configured in this run. The measurement includes the host, client and backend; it does not isolate gateway CPU overhead.
Where Ferrum Wins
Ferrum led the reported E2E TLS with backend latency and authenticated workloads. Choose tests that match your deployment; these results are not a general ranking.
Relevant Architecture Choices
Pre-Computed ConsumerIndex
Credentials are indexed into per-type HashMaps at config load time. Every authenticated request pays only a single O(1) HashMap lookup — no runtime parsing, no string allocation, no deep clone.
Arc<Consumer> Zero-Copy
The auth plugin stores Arc<Consumer> directly in the request context — only an atomic refcount bump. Envoy's Lua filter runs interpreted bytecode per request; Kong's plugin chain involves multiple Lua table lookups.
rustls + Connection Pooling
Ferrum uses pure-Rust rustls for both inbound and outbound TLS. Connection pools reuse established TLS sessions to backends, dramatically reducing handshake overhead under sustained E2E TLS load.
Lock-Free Config Reads
ArcSwap::load() for the configuration and route-table snapshots is a single atomic pointer load — no mutex, no spinlock — so a reload never stalls a request. The route lookup cache is a sharded DashMap, so a cache hit takes one short per-shard read lock rather than being lock-free.
Pre-Computed Header Names
The KeyAuth plugin lowercases the header name once at config load time. Envoy and Kong normalize headers on every request. Under 27K+ req/s, even this micro-optimization compounds.
Compiled Rust vs Scripting
Ferrum plugins are compiled Rust with zero interpreter overhead. Envoy uses a Lua VM for custom filters. Kong's entire plugin system runs in Lua (OpenResty). At high throughput, scripting overhead is measurable.
Run the Comparison Yourself
The benchmark harness is source available under
PolyForm Noncommercial or a commercial license.
These instructions were checked against
runner commit b818e551
on October 4, 2026. Use Bash and Git, plus wrk, python3,
a Rust/cargo toolchain, curl, docker with a running
daemon, and lsof. Cargo builds the native backend; Docker builds Ferrum
and pulls the other gateway images.
# Clone the repo
git clone https://github.com/ferrum-edge/ferrum-edge.git
cd ferrum-edge
git checkout --detach b818e551466465b286a02cbd01f369b6eb7fe428
# Install wrk: macOS (other prerequisites must also be installed)
brew install wrk
# Ubuntu alternative: sudo apt install wrk
# Run Ferrum, Kong, Tyk, KrakenD and Envoy (no Pingora)
./comparison/run_comparison.sh
# Open the HTML report: macOS
open comparison/results/comparison_report.htmlhost.docker.internal on macOS.
Ports 3001, 3443, 8000 and 8443 and the runner's fixed Docker resource names must
be free. It measures a direct baseline before gateway tests.
You can skip individual gateways via SKIP_GATEWAYS=tyk,krakend ./comparison/run_comparison.sh.
On Linux with a desktop, use xdg-open comparison/results/comparison_report.html;
otherwise open comparison/results/comparison_report.html in any browser.
Benchmark Provenance
These are historical local Apple Silicon results recorded in the repository performance summary. That summary does not record a run date or tested commit; these figures are not a performance certification of v0.9.5 or the current release. Payload, concurrency, protocol, hardware, and configuration affect results. The audited harness documentation describes new measurements with a roughly 10 KB JSON POST to /api/echo, not reproduction of the displayed historical tables.